We plan in distribute Node.JS webservers, for their advantage of async I/O. The Node.JS https servers use OpenSSL libraries.
It appears that OpenSSL has vulnerabilities resolved on a regular basis. This makes me wonder if I should move the SSL layer to a separate Java process / something more proven, that will not have buffer overflow, and other vulnerabilities.
The Oracle Solaris package repo publishes only an out of date release, so compilation from source would be necessary for prompt install.
There would of course be a delay between discovery->release->compilation->distribution to the servers running. And additional administration cost/delay in the event there is a problem with the build.
- How effective will prompt updates be against attackers? What kind of work would be necessary for the attacker, once a vulnerability is identified?
- Do you recommend an alternative, more secure approach to installing the https layer?
- Is there an older, more stable version of OpenSSL that is still maintained, and had a longer time to be proven secure?
Any input would be appreciated, including help with getting this question right.
Edit: A couple clarifications on how a separate library would be introduced, if that was to happen: The separate library would just be an implementation of a proxy https server, in a separate process. This is a brand-new implementation, so we wouldn't be switching, we would instead just 'not use' the Node.JS https
server library.